Introduction to Configuration Manager

New employees can work efficiently from day one.

When employees join the company, they have to wait for applications to be installed after they first log on.

When employees join the company, they log on and their applications are installed and are ready to be used.

Employees can use their mobile devices at work if the devices comply with security policies that are monitored and enforced. These policies include the following:

• Strong password

• Lock after period of inactivity

• Lost or stolen mobile devices are remotely wiped

Employees connect their mobile devices to Exchange Server for email service but there is limited reporting to confirm that they are in compliance with the security policies in the default Exchange ActiveSync mailbox policies. The personal use of mobile devices is at risk of being prohibited unless IT can confirm adherence to policy.

The IT organization can report mobile device security compliance with the required settings. This confirmation lets users continue to use their mobile device at work. Users can remotely wipe their mobile device if it is lost or stolen, and the help desk can wipe any user’s mobile device that is reported as lost or stolen.

Provide mobile device enrollment in a PKI environment for additional security and control.

Usually, business continuity takes precedence over installing required applications and software updates.

Applications and software updates that are required install during the day and frequently disrupt users from working because their computers slow down or restart during the installation.

Users can configure their working hours to prevent required software from installing while they are using their computer.

Adam makes sure that the new users have user accounts in Active Directory and creates a new query-based collection in Configuration Manager for these users. He then defines user device affinity for these users by creating a file that maps the user accounts to the primary computers that they will use and imports this file into Configuration Manager.

The applications that the new users must have are already created in Configuration Manager. He then deploys these applications that have the purpose of Required to the collection that contains the new users.

Because of the user device affinity information, the applications are installed to each user’s primary computer or computers before the user log on.

The applications are ready to use as soon as the user successfully logs on.

Adam creates an Exchange Server connector in Configuration Manager to manage the mobile devices that connect to the company’s on-premises Exchange Server. He configures this connector with security settings that include the requirement for a strong password and lock the mobile device after a period of inactivity.

Adam has Configuration Manager SP1, so for additional management for devices that run Windows Phone 8, Windows RT, and iOS, he obtains a Microsoft Intune subscription and then installs the Microsoft Intune connector site system role. This mobile device management solution gives the company greater management support for these devices. This includes making applications available for users to install on these devices, and extensive settings management. In addition, mobile device connections are secured by using PKI certificates that are automatically created and deployed by Intune. After configuring the Microsoft Intuneconnector, Adam sends an email message to the users who own these mobile devices for them to click a link to start the enrollment process.

For the mobile devices to be enrolled by Intune, Adam uses compliance settings to configure security settings for these mobile devices. These settings include the requirement to configure a strong password and lock the mobile device after a period of inactivity.

With these two mobile device management solutions, the IT organization can now provide reporting information about the mobile devices that are being used on the company network and their compliance with the configured security settings.

Users are shown how to remotely wipe their mobile device by using the Application Catalog or the company portal if their mobile device is lost or stolen. The help desk is also instructed how to remotely wipe a mobile device for users by using the Configuration Manager console.

In addition, for the mobile devices that are enrolled by Intune, Adam can now deploy mobile applications for users to install, collect more inventory data from these devices, and have better management control over these devices by being able to access more settings.

Adam lets users know that they can configure their business hours in Software Center and select options to prevent software deployment activities during this time period and when the computer is in presentation mode.

Because users can control when Configuration Manager deploys software to their computers, users remain more productive during their work day.

All computers run antimalware software that has up-to-date definition files and enables Windows Firewall.

Different computers run different antimalware solutions that are not always kept up-to-date and although Windows Firewall is enabled by default, users sometimes disable it.

Users are asked to contact the help desk if malware is detected on their computer.

All computers run the same antimalware solution that automatically downloads the latest definition update files and automatically re-enables Windows Firewall if users disable it.

The help desk is automatically notified by email if malware is detected.

Security settings for specific applications are regularly checked and remediated if it is necessary.

Computers run complex startup scripts that rely on computer group membership to reset registry values for specific applications.

Because these scripts only run at startup and some computers are left on for days, the help desk cannot check for configuration drift on a timely basis.

Registry values are checked and automatically remediated without relying on computer group membership or restarting the computer.

Laptops that move from the intranet to the Internet must be kept secure.

For users who travel, they frequently cannot connect over the VPN daily and these laptops become out of compliance with security requirements.

An Internet connection is all that is required for laptops to be kept in compliance with security requirements. Users do not have to log on or use the VPN.

Adam configures Endpoint Protection and enables the client setting to uninstall other antimalware solutions and enables Windows Firewall. He configures automatic deployment rules so that computers check for and install the latest definition updates regularly.

The single antimalware solution helps protect all computers by using minimal administrative overhead. Because the help desk is automatically notified by email message if antimalware is detected, problems can be resolved quickly. This helps prevent attacks on other computers.

Adam uses compliance settings to check for the presence of the specified applications. When the applications are detected, configuration items then check the registry values and automatically remediate them if they are out of compliance.

By using configuration items and configuration baselines that are deployed to all computers and that check for compliance every day, separate scripts that rely on computer membership and computer restarts are no longer required.

Adam makes sure that site system servers and computers have the PKI certificates that Configuration Manager requires for HTTPS connections, and then he installs additional site system roles in the perimeter network that accept client connections from the Internet.

Computers that move from the intranet to the Internet automatically continue to be managed by Configuration Manager when they have an Internet connection. Those computers do not rely on users logging on to their computer or connecting to the VPN.

These computers continue to be managed for antimalware and Windows Firewall, software updates, and configuration items. As a result, compliance levels automatically increase.

New computers are installed with Windows 7.

The help desk installs and configures Windows 7 for users and then sends the computer to the respective location.

New computers go straight to the final destination, are plugged into the network, and they automatically install and configure Windows 7.

Some computers must have more rigorous management policies.

Because of the more rigorous management policies, these computers are currently not managed by Configuration Manager.

Manage these computers by using Configuration Manager without additional administrative overhead to accommodate the exceptions.

Adam captures an operating system image from a computer that has Windows 7 installed and that is configured to the company specifications. He then deploys the operating system to the new computers by using unknown computer support and PXE. He also installs the Configuration Manager client as part of the operating system deployment.

New computers are up and running more quickly without intervention from the help desk.

Adam creates a collection for the computers that must have more rigorous policy settings and then creates a custom client device setting for this collection that includes disabling remote control, enables BitLocker PIN entry, and lets only local administrators to install software.

Adam configures role-based administration so that help desk engineers do not see this collection of computers to help ensure that they are not accidentally managed as a standard computer.

These computers are now managed by Configuration Manager but with specific settings that do not require a new site.

The collection for these computers is not visible to the help desk engineers to help reduce the possibility that they are accidentally sent deployments and scripts for standard computers.